1. Field of the Invention
The present invention relates to a method for minimizing the contributions of failed sensors in a measurement system comprising a plurality of redundant interconnected sensors. More particularly, this invention is directed to minimizing measurement errors in such a system by detecting and isolating the faulty sensors employing failure detection, isolation and correction ("FDIC") methods.
2. Description of the Prior Art
When redundant sensors are provided for measuring a quantity, it is theoretically possible to detect failures in one or a number of such sensors by comparison of the data provided by the sensors. If the faulty sensors are additionally isolated, then it is possible to eliminate the measuring failure by omitting the sensors determined to be faulty.
This general problem occurs in a multiplicity of applications including, for example, measurement of movement with inertial systems containing redundant inertial sensors (e.g. gyroscopes and accelerometers possibly possessing nonparallel sensing axes), and position determination in satellite navigation systems having redundant satellite configurations. The existing methods for solving the problem can be broadly divided into two categories. These are (i) grouping of the system into sensor combinations of minimal redundance by determining all individual combinations and employing combinatorial logic to determining the largest possible failure-free sensor combination (i.e. "parity methods") and (ii) isolating the individual sensor that contributes most to the overall discrepancy (Chi-square criterion) followed by elimination of that sensor ("maximum likelihood" methods).
The known disadvantages of such methods are, in the case of parity methods:
(a) The number of individual combinations of minimal redundance required to be taken into account grows combinatorially (i.e. as n!) with the number of sensors. Since the parity of each combination must be evaluated, cost increases commensurately. PA1 (b) Each individual parity is evaluated discretely as either "good" or "bad" by comparison with predetermined threshold values. A parity that only barely violates a threshold value is indistinguishable from a large threshold-value violation. The same is true of threshold-value undershoots. The resulting total pattern of the parity violations does not, therefore, permit unambiguous interpretation over a comparatively wide range of sensor failures, leaving interpretation to heuristic means. This can lead to unnecessary misinterpretations as the additional introduction of various ("large" and "small") threshold values can only party ameliorate the problem while increasing cost. PA1 (c) Since the selection of threshold values is generally fixed, an unexpectedly high noise level of all the sensor values leads to complete failure as it is then possible that all individual combinations will exceed the threshold values with discrimination no longer taking place beyond them. The threshold values must be matched to the worst possible case to avoid this problem. This leads to undesirably high insensitivity of the method in "normal operation". PA1 (d) As the individual parities are broadly divided into higher/lower than the threshold value, singularities (i.e. sensor data combinations that do not, in principle, permit unambiguous isolation of failure) can only be roughly detected and partly distinguished from unambiguous situations. The result of this is that either (1) singularities remain undiscovered or (2) cases that are actually unambiguous are treated as singularities. Failure to discover singularities can lead to incorrect decisions. Treating unambiguous cases as singularities can impair the integrity of the method since a less reliable information is generally relied upon in the treatment of singularities. PA1 (a) False isolation decisions can occur when multiple failures take place simultaneously since these methods are based upon the assumption that, at any particular given time, only one sensor delivers faulty data. PA1 (b) After the occurrence and isolation of an individual failure, it is necessary to reconfigure the parameters of the method in real time to the corresponding (n-1) sensor configuration to detect and further isolate later-occurring individual failures. The subsequent faulty behavior of the previously-isolated sensors is no longer included in the new configuration. Possible "recovery" of such sensors can only be detected by parallel processing of a plurality of configurations. This correspondingly increases the processing costs. PA1 geometrical interpretation of the properties of the parity space and their consequent use for isolating simultaneously occurring multiple failures; PA1 off-line analysis of the directions in the parity space and the provision of the isolation results in a precalculated table, PA1 optionally possible adaptive matching of the detection thresholds to the general noise level of the failure-free sensors. PA1 8 one-dimensional subspaces (lines) for characterizing uniaxial failures PA1 28 two-dimensional subspaces (planes) for characterizing biaxial failures PA1 56 three-dimensional subspaces for characterizing triaxial failures PA1 70 four-dimensional subspaces for characterizing four-axis failures
"Maximum likelihood" methods are subject to the following disadvantages: